]> git.donarmstrong.com Git - dsa-puppet.git/blob - modules/debian-org/manifests/init.pp
Allow setting main debian mirror via puppet
[dsa-puppet.git] / modules / debian-org / manifests / init.pp
1 class debian-org {
2
3         $debianadmin = [
4                 'debian-archive-debian-samhain-reports@master.debian.org',
5                 'debian-admin@ftbfs.de',
6                 'weasel@debian.org',
7                 'steve@lobefin.net',
8                 'paravoid@debian.org'
9         ]
10
11         package { [
12                         'klogd',
13                         'sysklogd',
14                         'rsyslog',
15                 ]:
16                 ensure => purged,
17         }
18         package { [
19                         'debian.org',
20                         'dsa-munin-plugins',
21                 ]:
22                 ensure => installed,
23                 require => [
24                         File['/etc/apt/sources.list.d/db.debian.org.list'],
25                         Exec['apt-get update']
26                 ]
27         }
28         package { [
29                         'apt-utils',
30                         'bash-completion',
31                         'dnsutils',
32                         'less',
33                         'lsb-release',
34                         'libfilesystem-ruby1.8',
35                         'mtr-tiny',
36                         'nload',
37                         'pciutils',
38                 ]:
39                 ensure => installed,
40         }
41
42         munin::check { [
43                         'cpu',
44                         'entropy',
45                         'forks',
46                         'interrupts',
47                         'iostat',
48                         'irqstats',
49                         'load',
50                         'memory',
51                         'ntp_offset',
52                         'ntp_states',
53                         'open_files',
54                         'open_inodes',
55                         'processes',
56                         'swap',
57                         'uptime',
58                         'vmstat',
59                 ]:
60         }
61
62         if getfromhash($site::nodeinfo, 'broken-rtc') {
63                 package { 'fake-hwclock':
64                         ensure => installed,
65                         require => [
66                                 File['/etc/apt/sources.list.d/db.debian.org.list'],
67                                 Exec['apt-get update']
68                         ]
69                 }
70         }
71
72         package { 'molly-guard':
73                 ensure => installed,
74         }
75         file { '/etc/molly-guard/run.d/10-check-kvm':
76                 mode    => '0755',
77                 source  => 'puppet:///modules/debian-org/molly-guard/10-check-kvm',
78                 require => Package['molly-guard'],
79         }
80         file { '/etc/molly-guard/run.d/15-acquire-reboot-lock':
81                 mode    => '0755',
82                 source  => 'puppet:///modules/debian-org/molly-guard/15-acquire-reboot-lock',
83                 require => Package['molly-guard'],
84         }
85
86         # This really means 'not wheezy'
87
88         if $::debarchitecture != 'armhf' {
89                 site::aptrepo { 'security':
90                         url        => 'http://security.debian.org/',
91                         suite      => "${::lsbdistcodename}/updates",
92                         components => ['main','contrib','non-free']
93                 }
94
95                 site::aptrepo { 'backports.debian.org':
96                         url        => 'http://backports.debian.org/debian-backports/',
97                         suite      => "${::lsbdistcodename}-backports",
98                         components => ['main','contrib','non-free']
99                 }
100
101                 if getfromhash($site::nodeinfo, 'hoster', 'mirror-debian') {
102                         site::aptrepo { 'volatile':
103                                 url        => getfromhash($site::nodeinfo, 'hoster', 'mirror-debian'),
104                                 suite      => "${::lsbdistcodename}-updates",
105                                 components => ['main','contrib','non-free']
106                         }
107                 } else {
108                         site::aptrepo { 'volatile':
109                                 url        => 'http://ftp.debian.org/debian',
110                                 suite      => "${::lsbdistcodename}-updates",
111                                 components => ['main','contrib','non-free']
112                         }
113                 }
114         }
115         site::aptrepo { 'backports.org':
116                 ensure => absent,
117                 keyid => '16BA136C',
118                 key => 'puppet:///modules/debian-org/backports.org.asc',
119         }
120
121         site::aptrepo { 'debian.org':
122                 ensure => absent,
123         }
124
125         site::aptrepo { 'db.debian.org':
126                 url        => 'http://db.debian.org/debian-admin',
127                 suite      => 'lenny',
128                 components => 'main',
129                 key        => 'puppet:///modules/debian-org/db.debian.org.asc',
130         }
131
132         if getfromhash($site::nodeinfo, 'hoster', 'mirror-debian') {
133                 site::aptrepo { 'debian':
134                         url        => getfromhash($site::nodeinfo, 'hoster', 'mirror-debian'),
135                         suite      => "${::lsbdistcodename}",
136                         components => ['main','contrib','non-free']
137                 }
138         }
139
140         file { '/etc/facter':
141                 ensure  => directory,
142                 purge   => true,
143                 force   => true,
144                 recurse => true,
145                 source  => 'puppet:///files/empty/',
146         }
147         file { '/etc/facter/facts.d':
148                 ensure => directory,
149         }
150         file { '/etc/facter/facts.d/debian_facts.yaml':
151                 content => template('debian-org/debian_facts.yaml.erb')
152         }
153         file { '/etc/apt/preferences':
154                 source => 'puppet:///modules/debian-org/apt.preferences',
155         }
156         file { '/etc/apt/trusted-keys.d/':
157                 ensure => directory,
158                 purge  => true,
159         }
160         file { '/etc/apt/apt.conf.d/local-compression':
161                 source => 'puppet:///modules/debian-org/apt.conf.d/local-compression',
162         }
163         file { '/etc/apt/apt.conf.d/local-recommends':
164                 source => 'puppet:///modules/debian-org/apt.conf.d/local-recommends',
165         }
166         file { '/etc/apt/apt.conf.d/local-pdiffs':
167                 source => 'puppet:///modules/debian-org/apt.conf.d/local-pdiffs',
168         }
169         file { '/etc/timezone':
170                 source => 'puppet:///modules/debian-org/timezone',
171                 notify => Exec['dpkg-reconfigure tzdata -pcritical -fnoninteractive'],
172         }
173         if $::hostname == handel {
174                 include puppetmaster::db
175                 $dbpassword = $puppetmaster::db::password
176         }
177         file { '/etc/puppet/puppet.conf':
178                 content => template('debian-org/puppet.conf.erb'),
179         }
180         file { '/etc/default/puppet':
181                 source => 'puppet:///modules/debian-org/puppet.default',
182         }
183         file { '/etc/cron.d/dsa-puppet-stuff':
184                 source => 'puppet:///modules/debian-org/dsa-puppet-stuff.cron',
185                 require => Package['debian.org'],
186         }
187         file { '/etc/ldap/ldap.conf':
188                 require => Package['debian.org'],
189                 source => 'puppet:///modules/debian-org/ldap.conf',
190         }
191         file { '/etc/pam.d/common-session':
192                 require => Package['debian.org'],
193                 content => template('debian-org/pam.common-session.erb'),
194         }
195         file { '/etc/pam.d/common-session-noninteractive':
196                 require => Package['debian.org'],
197                 content => template('debian-org/pam.common-session-noninteractive.erb'),
198         }
199         file { '/etc/rc.local':
200                 mode   => '0755',
201                 source => 'puppet:///modules/debian-org/rc.local',
202                 notify => Exec['rc.local start'],
203         }
204         file { '/etc/dsa':
205                 ensure => directory,
206                 mode   => '0755',
207         }
208         file { '/etc/dsa/cron.ignore.dsa-puppet-stuff':
209                 source  => 'puppet:///modules/debian-org/dsa-puppet-stuff.cron.ignore',
210                 require => Package['debian.org']
211         }
212
213         # set mmap_min_addr to 4096 to mitigate
214         # Linux NULL-pointer dereference exploits
215         site::sysctl { 'mmap_min_addr':
216                 key   => 'vm.mmap_min_addr',
217                 value => '4096',
218         }
219         site::alternative { 'editor':
220                 linkto => '/usr/bin/vim.basic',
221         }
222         site::alternative { 'view':
223                 linkto => '/usr/bin/vim.basic',
224         }
225         mailalias { 'samhain-reports':
226                 ensure => present,
227                 recipient => $debianadmin,
228                 require => Package['debian.org']
229         }
230
231         exec { 'apt-get update':
232                 path        => '/usr/bin:/usr/sbin:/bin:/sbin',
233                 refreshonly => true,
234         }
235
236         exec { 'dpkg-reconfigure tzdata -pcritical -fnoninteractive':
237                 path        => '/usr/bin:/usr/sbin:/bin:/sbin',
238                 refreshonly => true
239         }
240         exec { 'puppetmaster restart':
241                 path        => '/etc/init.d:/usr/bin:/usr/sbin:/bin:/sbin',
242                 refreshonly => true
243         }
244         exec { 'rc.local start':
245                 path        => '/etc/init.d:/usr/bin:/usr/sbin:/bin:/sbin',
246                 refreshonly => true
247         }
248         exec { 'init q':
249                 refreshonly => true
250         }
251 }